MALICIOUS — d02597f6bade76936d17cec840dd9213bca005732f7cc1494c6253c79cfe3f68

MALICIOUS — d02597f6bade76936d17cec840dd9213bca005732f7cc1494c6253c79cfe3f68 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the FakeLogin family. 2 of 53 detection engines flagged it.

Identification

• SHA-256: d02597f6bade76936d17cec840dd9213bca005732f7cc1494c6253c79cfe3f68
• SHA-1: abebafff222551f286aaba114de52352f7134b7c
• MD5: 8c723b8a662f09afa27187ff542d1b9f
• ssdeep: 768:S/xx0Ur2CdFgSr58eNB9+DWCYaPTIgI5ra2dkZ7jCirVQg09V70JCj0:SBc+DdkZ7eixQt77W1
• TLSH: T1F72F29B638AE7CEFC90D4C0A1E5854AE9B06E4DEA5B074E4E7CC4F443463D81EC2495A
• Submitted as: d02597f6bade76936d17cec840dd9213bca005732f7cc1494c6253c79cfe3f68
• File type: html · Size: 35469 bytes
• Verdict: malicious (88/100) · Family: FakeLogin

Detections (2 of 53 engines)

• YARA: PhishingKit (t4d): PK_Office365_Login_Clone
• Microsoft Defender: Phish:HTML/FakeLogin.VFD!MTB

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Contacted 25 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
• YARA: PhishingKit (t4d) flagged PK_Office365_Login_Clone (rule PK_Office365_Login_Clone) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://aadcdn.msftauth.net, https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupa, https://aadcdn.msftauth.net/shared/1.0/content/images/def - static signal, weight 0.35, confidence 0.60
• Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

277 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• settings-win.data.microsoft.com
• officeclient.microsoft.com
• oneocsp.microsoft.com
• odc.officeapps.live.com

Dropped files

• 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54 - 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54

Embedded URLs

• http://www.w3.org/TR/html4/strict.dtd
• https://aadcdn.msftauth.net
• https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupa
• https://aadcdn.msftauth.net/shared/1.0/content/images/def
• https://aadcdn.msftauth.net/ests/2.1/content/images/w
• https://aadcdn.msftauth.net/ests/2.1/content/images/personal
• https://aadcdn.msftauth.net/ests/2.1/content/images/
• https://login.microsoftonline.com/common/uxlogout
• https://login.microsoftonline.com/forgetuser
• https://autologon.mic
• https://autologon.microsoftazurea
• https://autologon.microsoftazu
• https://login.microsoftonline.com/common/instrumentation/repo
• https://login.microsoftonline.com/common/instrum
• https://go.microsoft.com/fwlink/p
• https://login.live.com/Me.srf
• https://login.live.com/oauth20_authori
• https://account.live.com/pas
• https://account.microsoft.com
• http://windows.microsoft.com/en-US/windows-live/sign-in-single-
• https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/log
• https://www.microsoft.com/en-
• https://privacy.microsoft.com/en-
• https://aadcdn.msftauth.net/est
• https://aadcdn.msftauth.net/ests/2.1/content/c

Embedded domains

• www.w3.org
• aadcdn.msftauth.net
• aadcdn.msauth.net
• live.com
• login.microsoftonline.com
• rosoftazuread-sso.com
• d-sso.com
• read-sso.com
• tologon.microsoftazuread-sso.com
• example.com
• example.onmicrosoft.com
• go.microsoft.com
• login.live.com
• account.live.com
• account.microsoft.com
• windows.microsoft.com
• www.microsoft.com
• privacy.microsoft.com
• ddcgroup.pl
• hotmail.co.uk
• www.office.com
• outlook.office365.com
• webshell.suite.office.com
• n.name
• t.co

Embedded IP addresses

• 40.79.167.10
• 52.123.252.236
• 85.210.196.11
• 20.247.184.142
• 4.230.171.124
• 20.165.94.63
• 20.184.175.12
• 20.165.94.54
• 40.99.133.210
• 20.112.250.133
• 52.123.129.14
• 52.123.128.14
• 52.123.252.219
• 135.234.160.246
• 203.26.79.13
• 135.233.95.80
• 52.148.114.188
• 40.84.97.4
• 20.184.175.16
• 52.178.17.3
• 72.145.35.104
• 48.192.143.121
• 74.179.71.159
• 52.110.12.38
• 52.110.12.31

More FakeLogin samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report